Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Stored Cross-Site Scripting Vulnerabilities

Vulnerability

Multiple stored cross-site scripting (XSS) vulnerabilities exist in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W routers. The vulnerabilities are due to insufficient input validation by the interface. An authenticated attacker with valid administrator credentials can inject malicious script via crafted HTTP requests, which is then stored and executed when other administrators access the affected pages. All firmware versions of these models are affected [1].

Exploitation

An attacker must have valid administrator credentials for the affected device. The web-based management interface is accessible over the local LAN by default, or over the WAN if remote management is enabled. The attacker sends a crafted HTTP request containing malicious script to a vulnerable input field. When another administrator views the page containing the stored script, the script executes in the context of the victim's browser session [1].

Impact

Successful exploitation allows the attacker to execute arbitrary script code in the context of the affected web-based management interface. This can lead to disclosure of sensitive browser-based information (e.g., session tokens, cookies) and potentially allow the attacker to perform administrative actions on behalf of the victim. The compromise is limited to the web interface and does not provide direct access to the underlying operating system [1].

Mitigation

Cisco has released firmware updates to address these vulnerabilities; refer to the Cisco Security Advisory [1] for the specific fixed versions. No workarounds are available. The remote management feature should be disabled if not required to reduce exposure [1].